feat: upgrading api keys to new format and keeping backwards legacy a…

[0xacb]

This pull request updates the authentication model for Ethiack Beacon to support new phx_-prefixed API keys that no longer require a secret, while retaining support for legacy key:secret pairs. The changes span Ansible, Helm, and Kubernetes manifests, providing clear migration instructions, improved validation, and updating documentation and templates to reflect the new credential scheme.

Credential model updates:

• New phx_-prefixed API keys are bearer tokens and do not require an API secret; legacy (non-phx_) keys still require a secret. Documentation, variable descriptions, and validation logic have been updated across Ansible, Helm, and Kubernetes to reflect this. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

Helm chart and Kubernetes manifest changes:

• Helm chart ethiack-beacon is bumped to version 0.2.0, making credentials.apiSecret optional and rendering credentials as data (base64-encoded) instead of stringData. This ensures that removing apiSecret actually deletes the key from the Secret. Detailed upgrade and migration instructions are provided for users moving from legacy to new keys. [1] [2] [3] [4] [5]

Ansible role improvements:

• Variable validation and templates now only require ethiack_api_secret for legacy keys, and omit it for phx_ keys. Documentation and examples have been updated to clarify usage and migration. [1] [2] [3] [4] [5] [6]

Documentation updates:

• All relevant documentation (README, Ansible, Helm, Kubernetes) has been revised to explain the new credential scheme, provide migration steps, and clarify which variables are required for each key type. [1] [2] [3] [4] [5] [6] [7] [8] [9]

Migration and upgrade guidance:

• Instructions are included for users upgrading from chart 0.1.0 to 0.2.0, especially when rotating from a legacy key:secret pair to a phx_ key, to ensure secrets are not orphaned in the cluster. [1] [2] [3]

These changes ensure a smoother transition to the new authentication model and prevent configuration errors when using new or legacy credentials.

[Copilot]

Pull request overview

This PR updates Beacon authentication configuration to support new phx_-prefixed API keys (bearer tokens without a secret) while retaining legacy key+secret behavior, aligning docs/templates across Ansible, Helm, and raw Kubernetes YAML.

Changes:

• Made apiSecret optional across deployment methods for phx_ keys, and omitted ETHIACK_API_SECRET when empty.
• Updated Helm chart to 0.2.0 and switched Secret rendering from stringData to data (base64) with upgrade guidance.
• Revised documentation and examples to describe the new credential model and migration steps.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Updates top-level quick starts and adds Helm upgrade/migration guidance for the new key format.
kubernetes/secret.yaml	Makes ETHIACK_API_SECRET optional/commented for phx_ keys in raw manifests.
kubernetes/README.md	Updates Kubernetes quick-start instructions to reflect optional secret usage.
helm/ethiack-beacon/values.yaml	Documents credential behavior and existingSecret requirements for phx_ vs legacy keys.
helm/ethiack-beacon/templates/secret.yaml	Renders Secret using data + base64 and conditionally includes ETHIACK_API_SECRET.
helm/ethiack-beacon/Chart.yaml	Bumps chart version to 0.2.0.
ansible/roles/ethiack-beacon/templates/beacon.env.j2	Omits ETHIACK_API_SECRET from the rendered env file when unset.
ansible/roles/ethiack-beacon/tasks/main.yml	Adjusts assertions so legacy keys require a secret while phx_ keys do not.
ansible/roles/ethiack-beacon/defaults/main.yml	Sets ethiack_api_secret default to empty to support phx_ keys cleanly.
ansible/README.md	Updates Ansible docs for the new credential scheme and usage patterns.
ansible/group_vars/all.yml	Clarifies legacy-only secret configuration and omission behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.